@overaihq/cli 0.14.2 → 0.14.3

package/README.md

@@ -157,6 +157,10 @@ send a literal value that starts with `@`.
 
 ## For AI agents
 
+To onboard an agent, point it at this README and paste:
+
+> I use OverAI. Help me get set up with the CLI (https://www.npmjs.com/package/@overaihq/cli): install it, get me logged in, and then walk me through onboarding.
+
 The CLI bundles its own guidance — no extra setup files needed. Point your
 agent at a cloned workspace and have it run:
 

package/dist/{chunk-FTBTDB2B.js → chunk-4QWKERK2.js}

@@ -386,26 +386,39 @@ var injectCodeMessageSchema = external_exports.object({
 // ../common/src/webPage.ts
 var webPageLanguage = ["react"];
 var configFlag = external_exports.union([external_exports.boolean(), external_exports.string()]).nullish().transform((value) => value === true || value === "true").catch(false);
-var webPageConfigSchema = external_exports.object({
-  language: external_exports.enum(["react"]).catch("react"),
-  /* Missing on legacy versions; invalid modes fail closed instead of granting workspace access. */
-  authorizationMode: external_exports.enum(["workspace", "viewer"]).default("workspace"),
+var webPageConfigFields = {
+  language: external_exports.enum(webPageLanguage),
+  /* Invalid modes fail closed instead of granting workspace access. */
+  authorizationMode: external_exports.enum(["workspace", "viewer"]),
   customTitle: external_exports.string().nullish(),
-  code: external_exports.string().default(reactDefaultTemplate),
+  code: external_exports.string(),
   dataSourceUrl: external_exports.string().nullish(),
-  filter: itemFilterExpressionRootSchema.nullish().catch(null),
+  filter: itemFilterExpressionRootSchema.nullish(),
   /* Drops the iframe's sandbox attribute — needed for storage, cookies, forms. */
-  noSandbox: configFlag,
+  noSandbox: external_exports.boolean().nullish(),
   /* Renders the page fullscreen for end users by hiding the workspace top bar. */
-  hideTopBar: configFlag,
+  hideTopBar: external_exports.boolean().nullish(),
   /*
    * Which iframe runtime renders the page. "v1" is the sandboxed srcdoc
    * iframe; "v2" serves the page from its own origin (separate renderer
-   * process, real localStorage). Absent or invalid reads as "v1" so a legacy
-   * config never fails to parse over the toggle.
+   * process, real localStorage).
    */
-  runtime: external_exports.enum(["v1", "v2"]).catch("v1")
+  runtime: external_exports.enum(["v1", "v2"])
+};
+var webPageConfigSchema = external_exports.object({
+  ...webPageConfigFields,
+  language: webPageConfigFields.language.catch("react"),
+  // Missing on legacy versions.
+  authorizationMode: webPageConfigFields.authorizationMode.default("workspace"),
+  code: webPageConfigFields.code.default(reactDefaultTemplate),
+  filter: webPageConfigFields.filter.catch(null),
+  noSandbox: configFlag,
+  hideTopBar: configFlag,
+  // Absent or invalid reads as "v1" so a legacy config never fails to parse
+  // over the toggle.
+  runtime: webPageConfigFields.runtime.catch("v1")
 });
+var webPageConfigUpdateSchema = external_exports.object(webPageConfigFields).partial();
 var webPageConfigWriteSchema = webPageConfigSchema.extend({
   noSandbox: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
   hideTopBar: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
@@ -420,8 +433,10 @@ var defaultWebPageTemplate = reactDefaultTemplate.replace(
 
 export {
   itemFilterExpressionRootSchema,
+  reactDefaultTemplate,
   webPageLanguage,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   defaultWebPageTemplate
 };

package/dist/index.js

@@ -4,8 +4,9 @@ import {
 } from "./chunk-WGPBYGU6.js";
 import {
   itemFilterExpressionRootSchema,
+  reactDefaultTemplate,
   webPageConfigSchema
-} from "./chunk-FTBTDB2B.js";
+} from "./chunk-4QWKERK2.js";
 import {
   external_exports
 } from "./chunk-PF6GZFT4.js";
@@ -27818,7 +27819,7 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-7BXDGWX5.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-ICODVQMY.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
@@ -27874,6 +27875,7 @@ var functionFiles = (id, name2, version) => {
     [`${stem}.ts`]: version.code,
     [`${stem}.meta.json`]: metaJson({
       inputSchema: version.inputSchema,
+      callerAccess: version.callerAccess,
       outputSchema: version.outputSchema,
       executionTimeout: version.executionTimeout,
       executionCpu: version.executionCpu,
@@ -27890,7 +27892,7 @@ var functionAdapter = {
           nodes {
             id name
             functionVersions(orderBy: [VERSION_NUMBER_DESC], first: 1) {
-              nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory }
+              nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory callerAccess }
             }
             functionDeployedVersion { versionNumber }
           }
@@ -27932,7 +27934,7 @@ var functionAdapter = {
     const data = await gqlRequest(
       `query CliFunctionVersion($functionId: String!, $versionNumber: Int!) {
         functionVersion(functionId: $functionId, versionNumber: $versionNumber) {
-          versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory
+          versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory callerAccess
         }
       }`,
       { functionId: id, versionNumber }
@@ -27947,12 +27949,12 @@ var functionAdapter = {
   push: async (id, files, message, expectedLatestVersion) => {
     const meta = JSON.parse(fileBySuffix(files, ".meta.json"));
     const data = await gqlRequest(
-      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int) {
+      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int, $callerAccess: String) {
         createFunctionVersion(input: { expectedLatestVersion: $expectedLatestVersion, functionVersion: {
           functionId: $functionId, code: $code, message: $message,
           inputSchema: $inputSchema, outputSchema: $outputSchema,
           executionTimeout: $executionTimeout, executionCpu: $executionCpu,
-          executionMemory: $executionMemory
+          executionMemory: $executionMemory, callerAccess: $callerAccess
         }}) { functionVersion { versionNumber } }
       }`,
       {
@@ -27960,6 +27962,8 @@ var functionAdapter = {
         functionId: id,
         code: fileBySuffix(files, ".ts"),
         message,
+        // Omission in older clones lets the database inherit the latest policy.
+        callerAccess: meta.callerAccess ?? null,
         // Match the webapp's save defaults so a missing meta doesn't zero out
         // limits, and so an explicit null doesn't hit the NOT NULL column.
         inputSchema: meta.inputSchema ?? "",
@@ -33936,31 +33940,37 @@ engine.registerTag("generatePassword", GeneratePasswordTag);
 
 // ../common/src/printablePage.ts
 var printablePageLanguage = ["liquid", "react"];
-var reactDefaultTemplate = `function App() {
-  return (
-    <div className="page">
-      <h1>My Page Title</h1>
-      <p>Page content goes here...</p>
-    </div>
-  );
-}`;
+var printablePageConfigFields = {
+  pageSize: external_exports.object({ width: external_exports.string(), height: external_exports.string() }),
+  pageMargins: external_exports.object({
+    top: external_exports.string(),
+    right: external_exports.string(),
+    bottom: external_exports.string(),
+    left: external_exports.string()
+  }),
+  language: external_exports.enum(printablePageLanguage),
+  code: external_exports.string(),
+  dataSourceUrl: external_exports.string().nullish(),
+  filter: itemFilterExpressionRootSchema.nullish(),
+  customTitle: external_exports.string().nullish()
+};
 var printablePageConfigSchema = external_exports.object({
-  pageSize: external_exports.object({
+  ...printablePageConfigFields,
+  // Per-key defaults so a stored object missing one dimension still reads.
+  pageSize: printablePageConfigFields.pageSize.extend({
     width: external_exports.string().default("8.5in"),
     height: external_exports.string().default("11in")
   }).prefault({}),
-  pageMargins: external_exports.object({
+  pageMargins: printablePageConfigFields.pageMargins.extend({
     top: external_exports.string().default("0.5in"),
     right: external_exports.string().default("0.5in"),
     bottom: external_exports.string().default("0.5in"),
     left: external_exports.string().default("0.5in")
   }).prefault({}),
-  language: external_exports.enum(printablePageLanguage).default("react"),
-  code: external_exports.string().default(reactDefaultTemplate),
-  dataSourceUrl: external_exports.string().nullish(),
-  filter: itemFilterExpressionRootSchema.nullish(),
-  customTitle: external_exports.string().nullish()
+  language: printablePageConfigFields.language.default("react"),
+  code: printablePageConfigFields.code.default(reactDefaultTemplate)
 });
+var printablePageConfigUpdateSchema = external_exports.object(printablePageConfigFields).partial();
 var printablePageRenderDiagnosticsSchema = external_exports.object({
   /** Absent when the render itself failed before any text existed. */
   renderedTextLength: external_exports.number().optional(),
@@ -35410,6 +35420,7 @@ var ID_PREFIXES = {
   mailbox: { prefix: "mbx", body: 10 },
   mailbox_address: { prefix: "mba", body: 10 },
   mailbox_message: { prefix: "mbm", body: 10 },
+  notification: { prefix: "ntf", body: 12 },
   organization_usage_credit: { prefix: "crd", body: 12 },
   organization_usage_transaction: { prefix: "utx", body: 12 },
   page: { prefix: "pg", body: 10 },
@@ -36668,8 +36679,13 @@ Rules that keep graphs healthy:
   of the same parent; never connect across loop boundaries.
 - Keep TYPESCRIPT_CODE nodes small and focused \u2014 split logic across nodes and
   let the graph orchestrate, rather than one big code block.
-- Node inputs reference upstream state via variableIds (e.g. STATE.S1, Liquid
-  {{S1.field}}). After renaming/removing a node, grep the document for its
+- Write TYPESCRIPT_CODE as a module:
+  \`export default async function step(state: StepState, ctx, env) { const s1 = await state.get("S1"); return s1.rows; }\`.
+  \`state.get\` fetches one step's output on first read (cached for that node's execution),
+  resolves undefined for a skipped step, and rejects for an id not visible
+  from the node. Bare snippets (STATE/OUTPUT globals) are legacy, being retired.
+- Node inputs reference upstream state via variableIds (e.g.
+  \`await state.get("S1")\`, Liquid {{S1.field}}). After renaming/removing a node, grep the document for its
   variableId \u2014 dangling references fail at runtime, not at push.
 - Bring IF_ELSE branches back together with an ALWAYS node.
 - A loop (LOOP_ARRAY/LOOP_RANGE) always resolves to its success handle once all
@@ -36733,9 +36749,10 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
 - SQL from pages: env.TBSxxx.sql tagged templates only; compose dynamic SQL by
   nesting sql fragments, sql([...]) for IN lists. sql.unsafe only for dynamic
   identifiers.
-- For end-user-facing workspaces, add page-to-page navigation (end users land
-  on the workspace homepage and can only follow links). "Hide Top Bar" gives
-  an app-like experience.
+- End-user-facing workspaces have two modes. App (the default): end users land
+  on the workspace homepage and can only follow links, so add page-to-page
+  navigation; "Hide Top Bar" gives an app-like experience. Pages: the top bar
+  lists every deployed page, so pages only need links to ones marked hidden.
 - Public pages (/public/:id) have no viewer identity \u2014 useCurrentUser() is
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
@@ -36784,8 +36801,14 @@ var functions = `# Function best practices
 Functions are TypeScript HTTP handlers in a Deno sandbox: full env SDK,
 esm.sh imports allowed. The CLI materializes <slug>.<id>.ts (code) and
 <slug>.<id>.meta.json (inputSchema, outputSchema, executionTimeout ms,
-executionMemory MB).
+executionMemory MB, callerAccess).
 
+- New functions allow only callers with workspace access by default. Set
+  callerAccess to "public" in meta.json only when an unauthenticated endpoint is
+  intended. Existing functions retain their saved policy when older meta.json
+  files omit this field. The policy is versioned: deploy the saved version to
+  change who can call the live endpoint. Workspace uses Authorization for the
+  platform bearer token; put additional application credentials in another header.
 - Functions are full HTTP apps: method + sub-path are forwarded to your code,
   and each execution records requestMethod/requestPath. Callers reach a route
   with env.FNxxx.call({ method, path: "/features/123" }) \u2014 path defaults to the

package/dist/{webPage-7BXDGWX5.js → webPage-ICODVQMY.js}

@@ -1,14 +1,16 @@
 import {
   defaultWebPageTemplate,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   webPageLanguage
-} from "./chunk-FTBTDB2B.js";
+} from "./chunk-4QWKERK2.js";
 import "./chunk-PF6GZFT4.js";
 import "./chunk-U67V476Y.js";
 export {
   defaultWebPageTemplate,
   webPageConfigSchema,
+  webPageConfigUpdateSchema,
   webPageConfigWriteSchema,
   webPageLanguage
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "@perygee/common": "0.0.0",
-    "@types/node": "^24.13.5",
+    "@types/node": "^24.19.0",
     "@types/proper-lockfile": "^4.1.4",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",